Azure Web and Mobile built-in role
Azure Spring Cloud Service Registry Contributor
Reads, writes, and deletes user-application registration information in the managed Spring Cloud Service Registry through DataActions only. It does not manage the Azure Spring Apps resource through the control plane. Azure Spring Apps retires on March 31, 2028.
Role-definition permissions are imported from Microsoft Learn. Practical scope, use cases, prerequisites, best practices, security considerations, assignment guidance, and relationships have been reviewed against the official sources below.
Role definition ID: f5880b48-c26d-48be-b172-7927bfa1c8f1
Control-plane actions (0)
None — this role grants no control-plane management actions.
Data-plane actions (3)
Microsoft.AppPlatform/Spring/eurekaService/readMicrosoft.AppPlatform/Spring/eurekaService/writeMicrosoft.AppPlatform/Spring/eurekaService/delete
Excluded actions (0)
None
Assignable scopes (1)
/
Practical scope
Assign on the existing Azure Spring Apps service instance containing the managed Service Registry. A parent-scope assignment is inherited by registries in additional instances, while service-instance scope bounds registration changes to one retiring deployment.
Common use cases (2)
- Allow an external Spring Boot application, service principal, managed identity, or migration tool to register with and update the managed Service Registry using Microsoft Entra token authentication.
- Change or remove registrations during a controlled migration from an existing Basic or Standard Azure Spring Apps deployment.
Prerequisites (2)
- An existing Basic or Standard Azure Spring Apps instance must expose the managed Service Registry endpoint; applications running inside the service are normally wired automatically with platform-managed certificates.
- The external principal must obtain a Microsoft Entra token, and the registration change must support an approved operational or migration workflow.
Best practices (3)
- Use Service Registry Reader when the principal only inspects registered applications.
- Assign directly on the service instance, protect service-principal credentials, and remove the role when the external registration or migration workflow ends.
- Move service discovery to a supported replacement before Azure Spring Apps retires on March 31, 2028.
Security considerations (3)
- The role can write and delete application registration information used for service discovery, potentially changing which service instances clients discover or disrupting discovery.
- It combines read and mutation authority over the Service Registry data plane even though it cannot manage the Azure Spring Apps resource itself.
- A parent-scope assignment extends registration mutation authority across every inherited Spring Apps instance.
Assignment guidance
Assign the Service Registry Contributor directly on the existing Azure Spring Apps service instance to the external application or migration identity that must write registrations. Use Reader for observation, document the migration deadline, and remove the assignment after service discovery moves to the replacement platform.
Related roles (1)
- Azure Spring Cloud Service Registry Reader: Provides read access to registered-application information without write or delete DataActions.
Common questions
When should I assign the Azure Spring Cloud Service Registry Contributor Azure role?
Assign Azure Spring Cloud Service Registry Contributor when you need to: Allow an external Spring Boot application, service principal, managed identity, or migration tool to register with and update the managed Service Registry using Microsoft Entra token authentication.; and Change or remove registrations during a controlled migration from an existing Basic or Standard Azure Spring Apps deployment.. Practical scope: Assign on the existing Azure Spring Apps service instance containing the managed Service Registry. A parent-scope assignment is inherited by registries in additional instances, while service-instance scope bounds registration changes to one retiring deployment.
What permissions does the Azure Spring Cloud Service Registry Contributor Azure role grant?
The role definition grants 3 combined control-plane and data-plane actions. Representative operations include: Microsoft.AppPlatform/Spring/eurekaService/read; Microsoft.AppPlatform/Spring/eurekaService/write; and Microsoft.AppPlatform/Spring/eurekaService/delete. Review the permission sections above for the complete definition and exclusions.
What are the security risks of the Azure Spring Cloud Service Registry Contributor Azure role?
Key considerations when assigning Azure Spring Cloud Service Registry Contributor: The role can write and delete application registration information used for service discovery, potentially changing which service instances clients discover or disrupting discovery.; It combines read and mutation authority over the Service Registry data plane even though it cannot manage the Azure Spring Apps resource itself.; and A parent-scope assignment extends registration mutation authority across every inherited Spring Apps instance.. Follow the assignment guidance above and use the narrowest practical scope.
Editorial sources (7)
- Azure built-in roles for Web and Mobile - Azure RBAC | Microsoft Learn →
Supports: Description, Security considerations. Retrieved 2026-07-17.
- Understand Azure role definitions →
Supports: Description, Security considerations. Retrieved 2026-07-17.
- Steps to assign an Azure role →
Supports: Assignment guidance. Retrieved 2026-07-17.
- Understand scope for Azure RBAC →
Supports: Practical scope, Assignment guidance. Retrieved 2026-07-17.
- Best practices for Azure RBAC →
Supports: Best practices, Assignment guidance. Retrieved 2026-07-17.
- Access Config Server and Service Registry →
Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-17.
- Azure Spring Apps retirement announcement →
Supports: Description, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance. Retrieved 2026-07-17.